The Privacy Rule allows the use and disclosure of PHI without getting an individual’s authorization. Situations where public health oversight, law enforcement, possible abuse or domestic violence of adults and minors and responding to legal and court proceedings are times when PHI might be shared. Regardless of the reasons, these types of disclosures must meet minimum necessary requirements for disclosure.
- Health Oversight Activities
- Health Oversight A gencies Disclosure
- Oversight activities of the health care system and government benefit programs (e.g., audits, investigations)
- Serious Threat to Health or Safety
- Disclosure to Prevent Serious Threat or Safety
- Person or public to prevent or lessen the threat (including the target of the threat)
- Law enforcement to identify or apprehend an escapee or violent criminal
- Victims of Abuse, Neglect or Domestic Violence
- Disclosure to Government Authorities as authorized by law
- Regarding victims of abuse, neglect, or domestic violence
- Child Abuse or Neglect
- Disclosure to Report to Public Health or Government Authority as authorized by law
- PHI may be disclosed for known or suspected child abuse or neglect
- Adult Victims of Abuse, Neglect, or Domestic Violence
- Disclosure to Government Authority (e.g., Social Services, Protective Services)
- As required by law and disclosure complies with and limited to relevant requirements of law
- Individual agrees to disclosure
- Disclosure is authorized by statute or regulation and
- It is Tenet’s professional judgment the disclosure is necessary, or
- Disclosure is authorized by statute or regulation when an individual is not able to authorize and law enforcement represents that the PHI is not intended to be used against the individual and an immediate enforcement activity may be impacted by waiting for the individual to authorize disclosure of the PHI
- Quality, Safety or Effectiveness of a Product or Activity Regulated by the FDA
- FDA Jurisdiction
- Disclosure made to person subject to FDA jurisdiction
- “Person” can be an individual, entity( partnership, corporation, or association)
- Party responsible for an FDA-regulated product may be found on product label or other sources of labeling (e.g., Physician’s Desk Reference)
- Disclosure Examples
- Collecting or reporting adverse events
- Product defects or problems
- Biological product deviations
- Tracking FDA-regulated products
- Enabling product recalls, repairs, replacement or look back
- Conducting post-marketing surveillance
- Public Health Interventions or Investigations
- Disclosure to a person who is at risk of contracting or spreading a disease
- Workplace Medical Surveillance
- Disclosure at the request of an employer of an individual’s PHI for workplace medical surveillance or evaluating work-related illness and injuries
- Must comply with OSHA, the MSHA or the requirements of State laws
- Information is limited to provider’s findings about the medical surveillance
- Must provide the individual with written not ice of the planned disclosure or post a notice at the worksite if that is where the service is provided
- Disclosure to a School Regarding a Student or Prospective Student
- Disclosure to a school abouta student or prospective student
- PHI must be limited to proof of immunization
- School is required by State or other law to have proof of immunization
- Disclosure agreement is obtained prior to the disclosure from parent or guardian
- Required by Law
- Statute, regulation, or court orders
- May be without individual authorization
- Judicial and Administrative Proceedings
- Order from a court or administrative tribunal
- Response to a subpoena or other lawful process
- Assurance of notice to individual or
- Protective order
- Law Enforcement Purposes
- Required by law (e.g., court orders, warrants, subpoenas) and administrative requests
- Identifying or locating a suspect, fugitive, material witness, or missing person
- Responding to law enforcement official’s request for information about a victim or suspected victim of a crime
- Alerting law enforcement of a person’s death (if believe criminal activity caused the death)
- Belief that PHI is evidence of a crime that occurred on Tenet premises
- Informing law enforcement is necessary about the commission and nature of a crime, location of crime or crime victims and perpetrator of crime for medical emergencies not happening on Tenet premises
- Essential Government Functions
- Proper execution of a military mission
- Conducting authorized intelligence and national security activities
- Providing protective services to the President
- Medical suitability determinations for U.S. State Department employees
- Protecting health and safety of inmates or employees in a correctional institution
- Determining eligibility and enrollment in certain government benefit programs
- Workers’ Compensation Laws and Program Compliance
- Activities Related to Deceased Persons (Funeral Directors and Coroners and Medical Examiners)
- Cadaveric Organ, Eye, or Tissue Donation
- Research Development and Purposes